ab03e5b35861db02db66095ef7f607698798fdfefde79df982da43e9e97ec3bf

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe
Size

50KB
MD5

d5ef1a51b704d287ee20cb595e5f9a8f
SHA1

e2781aaaadbf043e0313fabeeb2acdb303729bf6
SHA256

ab03e5b35861db02db66095ef7f607698798fdfefde79df982da43e9e97ec3bf
SHA512

38f722f1c9959e57564d138c97c6810c1f04c6e3ab3158a2a6e84dc7b84fa93a9bc784d49493eb6a9fb406ac06b72bdb239a407471ace3344d47e58340b5934f
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55id3AMWZY/:X6QFElP6n+gJQMOtEvwDpjB0GIWiWLi/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000014230-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000014230-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2092	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2344	2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2092	2344	2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe	28
PID 2344 wrote to memory of 2092	2344	2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe	28
PID 2344 wrote to memory of 2092	2344	2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe	28
PID 2344 wrote to memory of 2092	2344	2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
51KB

MD5
eaa6cc5067c811033337801ace54bb31

SHA1
a438cb160e8237728c50cb4fc81468e2d8fa9800

SHA256
c35eae18e6c407f58f0486df9f051041a3834a4dc1139e995a812644b8e27615

SHA512
2e7ab9cb6da265d3cbcaca053df0d2b6c296fc56d5b7cb843a13cd4b39c44752f8a44571c7cfd8646af56988871724b4a9a35e537e2631c4ffc9c670088459de

Download Submit
memory/2092-22-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2092-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2344-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2344-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2344-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download